PHPAML

Documentation · Chapter 08

Protect the identity
carried by the session.

The session cookie contains an identifier, not usually all data. If stolen, the server may mistake an attacker for the user.

We secure reading-list in layers without pretending one option is enough.

Settings applied by PHPAML

HttpOnlyJavaScript cannot read the cookie
Securecookie sent only over HTTPS
SameSite=Lax / Strictlimits cross-site sending
use_strict_moderejects uninitialized identifiers
use_only_cookiesforbids the identifier in URLs

Configure lifetime and SameSite

phpaml — zsh
"session": {
  "lifetime": 7200,
  "same_site": "Lax"
}

PHPAML accepts Lax or Strict. Lax generally fits normal Web navigation; Strict further reduces cross-site sending but may disrupt some external flows.

Regenerate after identity changes

phpaml — zsh
// Après une connexion réussie
$session->regenerate();
$session->set('user_id', $user->id);

// À la déconnexion
$session->remove('user_id');
$session->regenerate();

Regeneration invalidates the old identifier and limits session fixation. HTTPS remains essential: without transport encryption, other protections are insufficient.